[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261026151503.GF23438@brightrain.aerifal.cx>
Date: Mon, 26 Oct 2026 11:15:03 -0400
From: Rich Felker <dalias@...c.org>
To: Thai Duong <thai@...if.io>
Cc: musl@...ts.openwall.com
Subject: Re: [SECURITY] musl: out-of-bounds read in regexec()
backtracking (src/regex/regexec.c, 1.2.6)
On Mon, Oct 26, 2026 at 05:35:06AM -0700, Thai Duong wrote:
> Hello,
>
> Calif.io, working with Anthropic, is reporting a memory-safety issue
> in musl's regex matcher. In tre_tnfa_run_backtrack()
> (src/regex/regexec.c), the backtracking retry path rolls back the
> match state but not pos_add_next, so after a retry GET_NEXT_WCHAR
> advances the byte position by a stale length. On a subject that mixes
> single-byte and multibyte characters the recorded byte offsets desync
> and the final strncmp (regexec.c:785) reads past the end of the
> subject buffer. It is reachable through the exported regexec() when
> the application uses a backreference pattern and passes an
> attacker-controlled subject string, which regexec is documented to
> accept. It is present at v1.2.6 and master.
>
> The full write-up and a source-level reproduction are in the attached
> report, and the proof of concept is attached as ANT-2026-HMXB71C3.zip
> and also mirrored at
> https://drive.google.com/file/d/1AUXONoLV-U5XDuOvLk9IbjEEiRR8cI1p/view.
>
> This issue was found by Claude and verified by Calif.io engineers. Our
> reference: ANT-2026-HMXB71C3.
If accurate this is a bug, but not a security one. The ability to
provide attacker-controlled BREs is inherently a DoS vector through
exponential-time matching. I'll check it out and see if we can get a
fix in for the 1.2.7 release.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
